Statuses
pending → in_progress → in_review | declined | approved (+ expired).
Idempotency
Posting twice with the same(workflow_id, vendor_data) while a session is still active returns the existing one — never two parallel sessions for the same user.
Webhooks
Setcallback on the session (or one global webhook destination) and Contra POSTs { session_id, status, vendor_data, decision } on every status transition.
See webhooks.